[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fHemlnvQx4oB0O_OTj039cFRlf_Siyyb56aBtDzUCqW4":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"deb1d7aa-b038-4995-a383-e362feb5fb75","supercomputer-cryptojacking-highlights-academic-network-security-gaps","e7af5a38-2c6e-4621-a7f1-7855c29b0af4","Supercomputer Cryptojacking Highlights Academic Network Security Gaps","Over three years, two Canadian nationals compromised university supercomputers across four US states to mine cryptocurrency, exploiting weak access controls and leveraging fraudulent VPN infrastructure to conceal their activity. The root cause lies in insufficient access control enforcement and failure to detect anomalous resource consumption on high-performance computing systems. Academic institutions often prioritize open access for research collaboration, inadvertently creating permissive environments that attackers can exploit. The prolonged duration of the campaign — three years — underscores a critical failure in monitoring and anomaly detection, since cryptomining generates distinctive, sustained CPU and GPU spikes that should trigger alerts. This incident matters because unauthorized use of research supercomputers disrupts legitimate academic work, wastes institutional resources, and demonstrates that even non-traditional targets hold significant value for cybercriminals.","**Immediate actions:**\n- Audit all remote access credentials and VPN accounts, revoking any that are unused, unrecognized, or not tied to verified identities.\n- Deploy resource utilization monitoring on all high-performance computing nodes to alert on sustained anomalous CPU\u002FGPU spikes consistent with cryptomining.\n\n**Long-term improvements:**\n- Implement multi-factor authentication (MFA) for all remote access pathways, including VPN and SSH connections to research computing infrastructure.\n- Enforce least-privilege access policies so that only authorized researchers with a documented need can connect to supercomputing resources.\n- Establish network segmentation between high-performance computing clusters and general university networks to limit lateral movement opportunities.\n\n**Detection measures:**\n- Deploy a SIEM solution configured with use-case rules for cryptomining indicators such as connections to known mining pools, unusual outbound traffic, and runaway compute processes.\n- Conduct regular log reviews and behavioral analytics on supercomputer job queues to identify jobs submitted by unauthorized or anomalous accounts.",[12,13,14,15,16,17,18],"CIS Control 6: Access Control Management","CIS Control 13: Network Monitoring and Defense","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1496: Resource Hijacking","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":20,"NIST SP 800-53 SI-2: Flaw Remediation":21,"MITRE ATT&CK T1496: Resource Hijacking":22,"CIS Control 6: Access Control Management":23,"CIS Control 13: Network Monitoring and Defense":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"NIS2 requires incident handling and monitoring controls for essential services; universities operating critical research infrastructure should implement equivalent standards to detect and respond to multi-year intrusion campaigns of this type.","Attackers likely exploited known vulnerabilities to gain initial footholds; a disciplined patch and flaw remediation process would have reduced the attack surface available to the perpetrators.","This technique directly describes the adversaries' goal of hijacking computing resources for cryptomining, and defenders with detections mapped to this technique would have flagged the sustained anomalous resource consumption.","The attackers maintained persistent access over three years; enforcing strict, regularly reviewed access control policies with MFA would have prevented or dramatically shortened unauthorized entry into university systems.","Continuous network monitoring tuned to detect cryptomining traffic patterns and connections to mining pools would have identified the malicious activity far earlier in the campaign.","Without a formal program to identify and remediate technical vulnerabilities in internet-facing academic systems, the universities remained exposed to exploitation over the entire three-year campaign.","Fraudulent VPN infrastructure was used to manage attacks, indicating weak identity verification; strong authentication and identity governance controls would have blocked or exposed the unauthorized access.","published","2026-11-04T13:21:51.475564+00:00","2026-11-04T13:21:51.408+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fwww.securityweek.com\u002Fcanadian-extradited-to-us-over-cryptomining-hacks-on-university-supercomputers\u002F","canadian-extradited-to-us-over-cryptomining-hacks-on-university-supercomputers-165425","Canadian Extradited to US Over Cryptomining Hacks on University Supercomputers",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":42,"name":43,"slug":44,"description":45,"color":46},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",[],[49,53,57],{"slug":50,"name":51,"problem":52},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",{"slug":54,"name":55,"problem":56},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":58,"name":59,"problem":60},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen."]